PT-2026-33219 · Unknown · Async Http Client

Published

2026-04-14

·

Updated

2026-05-18

·

CVE-2026-40490

CVSS v3.1

6.8

Medium

VectorAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions AsyncHttpClient versions prior to 2.14.5 AsyncHttpClient versions prior to 3.0.9
Description When redirect following is enabled via followRedirect(true), the library forwards Authorization and Proxy-Authorization headers and Realm credentials to arbitrary redirect targets, regardless of changes to the domain, scheme, or port. This leads to credential leakage during cross-domain redirects and HTTPS-to-HTTP downgrades. Furthermore, setting stripAuthorizationOnRedirect to true does not prevent the Realm object containing plaintext credentials from being propagated, which causes the NettyRequestFactory function to re-generate credentials for Basic and Digest authentication schemes. An attacker controlling a redirect target through methods such as open redirect, DNS rebinding, or MITM on HTTP can capture Bearer tokens, Basic auth credentials, or other Authorization header values.
Recommendations Update to version 2.14.5. Update to version 3.0.9. Set stripAuthorizationOnRedirect(true) in the client configuration and avoid using Realm-based authentication while redirect following is enabled. Disable redirect following by setting followRedirect(false) and handle redirects manually with origin validation.

Fix

Information Disclosure

Weakness Enumeration

Related Identifiers

CLEANSTART-2026-JU62349
CLEANSTART-2026-WK99982
CVE-2026-40490
GHSA-CMXV-58FP-FM3G

Affected Products

Async Http Client